better-auth
Page établie d’après les avis qui citent ce paquet : ses métadonnées de registre (versions, licence, dépendances) n’ont pas encore été récupérées par ce service.
En bref
- Écosystème
- npm
- État de vulnérabilité
- 26 avis sans verdict
Avis (26)
| Avis | Versions affectées | Dernière version |
|---|---|---|
| GHSA-2vg6-77g8-24mp Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows | 0.3.4 – < 1.6.11 | Indéterminé |
| GHSA-36rg-gfq2-3h56 Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes | < 1.2.10 | Indéterminé |
| GHSA-392p-2q2v-4372 Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption | 1.4.8-beta.7 – < 1.6.0 | Indéterminé |
| GHSA-44jh-23m7-hpcf @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL | 1.6.17 – < 1.7.7 | Indéterminé |
| GHSA-569q-mpph-wgww Better Auth affected by external request basePath modification DoS | < 1.4.2 | Indéterminé |
| GHSA-7w99-5wm4-3g79 @better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive | < 1.6.11 | Indéterminé |
| GHSA-86j7-9j95-vpqj Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp | < 1.6.13 ; 1.7.0-beta.0 – < 1.7.0-beta.4 | Indéterminé |
| GHSA-8jhw-6pjj-8723 Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint | < 1.1.6 | Indéterminé |
| GHSA-965c-763c-88jm better-auth: OAuth state can be used as a Magic Link to sign in as another user | 1.4.0-beta.18 – < 1.7.7 | Indéterminé |
| GHSA-99h5-pjcv-gr6v Better Auth: Unauthenticated API key creation through api-key plugin | < 1.3.26 | Indéterminé |
| GHSA-9h47-pqcx-hjr4 Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default | < 1.6.11 | Indéterminé |
| GHSA-9x4v-xfq5-m8x5 Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting) | 0.0.2 – < 1.1.16 | Indéterminé |
| GHSA-cq3f-vc6p-68fh Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending | 1.6.0 – < 1.6.11 | Indéterminé |
| GHSA-fmh4-wcc4-5jm3 Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin | < 1.6.11 | Indéterminé |
| GHSA-g38m-r43w-p2q7 Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email | < 1.6.11 | Indéterminé |
| GHSA-hjpm-7mrm-26w8 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter | < 1.1.20 | Indéterminé |
| GHSA-p6v2-xcpg-h6xw Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation | < 1.4.17 ; 1.5.0-beta.1 – < 1.5.0-beta.9 | Indéterminé |
| GHSA-pw9m-5jxm-xr6h Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins | < 1.6.11 | Indéterminé |
| GHSA-q84f-53jg-9ppm better-auth: Device login approval does not show the requesting client or permissions | 1.3.8-beta.3 – < 1.7.0-rc.3 | Indéterminé |
| GHSA-qq9h-g4jm-xgf3 Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in | 1.1.3 – < 1.6.22 ; 1.7.0-beta.0 – < 1.7.0-beta.10 | Indéterminé |
| GHSA-r4xp-prcw-77qf better-auth: OAuth Proxy lets an attacker sign in as another user | 1.5.0-beta.12 – < 1.7.7 | Indéterminé |
| GHSA-vp58-j275-797x Better Auth allows bypassing the trustedOrigins Protection which leads to ATO | < 1.1.21 | Indéterminé |
| GHSA-wmjr-v86c-m9jj Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions | 1.3.34 – < 1.4.0 | Indéterminé |
| GHSA-wxw3-q3m9-c3jr Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE | < 1.6.2 | Indéterminé |
| GHSA-x732-6j76-qmhm Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits | < 1.4.5 | Indéterminé |
| GHSA-xg6x-h9c9-2m83 Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache) | < 1.4.9 | Indéterminé |
Avis retirés (1)
Retirés par leur éditeur : ils ne concernent aucune version et ne sont pas comptés ci-dessus.
- GHSA-3q45-2fh7-66cj Duplicate Advisory: better-auth has an external request basePath modification DoS · retiré le
Sources
| Source | Licence |
|---|